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PRELIMINARY AMENDMENT 

Box Patent Application 

Assistant Commissioner for Patents 

Washington, D.C. 20231 

Dear Sir: 

Please enter the following preliminary amendment into the above-referenced 
application. 

ABSTRACT 

Please insert the attached abstract into the application as the last page thereof. 

CLAIMS 

Please amend claims 1-4, 6-8, 10, 12-35 as follows. A clean copy of the 
amended and new claims is included below. A marked up copy of the entire claim set 
is included in Appendix A. 

1 . (AMENDED) An interception method for performing a lawful interception in a 
packet network, comprising the steps of: 
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a) providing a first network element having an interception function for intercepting 
data packets; 

b) controlling said interception function by an interception control means 
implemented in a second network element; and 

c) transmitting an intercepted data packet from said first network element via said 
packet network to an interception gateway element providing an interface to at least 
one intercepting authority. 

2. (AMENDED) A method according to claim 1 , wherein said interception gateway 
element is integrated in said second network element. 

3. (AMENDED) A method according to claim 1 , wherein a header of a data packet 
is read by said network element and data packets to be intercepted are duplicated. 

4. (AMENDED) A method according to claim 1 , wherein said intercepted data 
packet is transmitted to said interception gateway element using a secure tunnel. 

5. A method according to claim 4, wherein said secure tunnel is implemented by 
an encryption processing. 

6. (AMENDED) A method according to claim 1 , wherein said intercepted data 
packet is transmitted via interworking units and encrypted between said interworking 
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units, when said first network element and said interception gateway element are 
arranged in separate network segments. 

7. (AMENDED) A method according to claim 1 , wherein said first network element 
is provided in each network segment of said packet network. 

8. (AMENDED) A method according to claim 1 , wherein received intercepted data 
packets are collected in said interception gateway element and supplied to an 
interface of said at least one intercepting authority. 

9. A method according to claim 8, wherein said interface comprises a first 
interface for administrative tasks, a second interface for network signaling, and a third 
interface for intercepted user data. 

10. (AMENDED) A method according to claim 1 , wherein said intercepting function 
comprises a packet sniffing and filtering function. 

11. A method according to claim 1 0, wherein said intercepting function is 
implemented in the Gn interface. 

12. (AMENDED) A method according to claim 1 , wherein said interception function 
comprises reading data packets, analyzing the header of the data packets as to 
whether the data packet should be intercepted or not, and transmitting the data packet 
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to said interception gateway element, and a management function for interception and 
transmission criteria. 

1 3. (AMENDED) A method according to claim 1 , wherein an alarm is transmitted to 
said interception gateway element and all interception information of a respective 
network element is deleted, when a breakage of a casing of the respective network 
element has been detected. 

14. (AMENDED) A method according to claim 1 , wherein fake packets are 
transmitted from said network element to said interception gateway element. 

1 5. (AMENDED) A method according to claim 14, wherein said fake packets are 
transmitted at random or triggered at any passing packet, such that the total load of 
intercepted and fake packets transmitted to said interception gateway element is 
constant. 

16. (AMENDED) A method according to claim 1 , wherein said intercepted data 
packet is padded to a maximum length. 

17. (AMENDED) A method according to claim 1 , wherein a time information is 
added to said intercepted data packet. 
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18. (AMENDED) An interception system for performing a lawful interception in a 
packet network, comprising: 

a) a first network element having an interception function for intercepting data 
packets and comprising a transmitting means for transmitting an intercepted data 
packet to said packet network; 

b) an interception control means implemented in a second network element and 
controlling the interception function; and 

c) an interception gateway element having a receiving means for receiving said 
intercepted data packet and an interface means for providing an interface to at least 
one intercepting authority. 

1 9. (AMENDED) A system according to claim 1 8, wherein said second network 
element corresponds to said interception gateway element. 

20. (AMENDED) A system according to claim 18, wherein said first network 
element further comprises an encrypting means for encrypting said intercepted data 
packet. 

21 . (AMENDED) A system according to claim 1 8, wherein said first network 
element further comprises a means for generating fake packets to be transmitted with 
said intercepted data packets. 
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22. (AMENDED) A system according to claim 18, wherein said first network 
element comprises a reading means for reading a header of a received data packet 
and for duplicating a data packet to be intercepted. 

23. (AMENDED) A system according to claim 22, wherein said reading means is 
arranged to pad said copied data packet to a maximum length. 

24. (AMENDED) A system according to claim 18, wherein said first network 
element is a gateway element of said packet network. 

25. (AMENDED) A system according to claim 1 8, wherein said first network 
element is a BG, an SGSN or a GGSN. 

26. (AMENDED) A system according to claim 24, wherein an interception 
information defining a data packet to be intercepted is included in a context information 
supplied to said first network element and used for routing data packets. 

27. (AMENDED) A system according to claim 26, wherein said interception control 
means comprises a storing means for storing an interception list, and wherein said 
interception control means is arranged to add said interception information to said 
context information supplied to said first network element. 
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28. (AMENDED) A system according to claim 1 8, wherein said first network 
element is arranged in each segment of said packet network. 

29. (AMENDED) A system according to claim 1 8, wherein said first network 
element comprises a control means for controlling interception and encryption 
processing in accordance with an interception setting instruction received from said 
interception control means. 

30. (AMENDED) A system according to claim 18, wherein said interception 
gateway element comprises a memory means for storing received intercepted data 
packets before supplying them to said interface means. 

31 . (AMENDED) A system according to claim 30, wherein said interception 
gateway element comprises a decryption means for removing an encryption of the 
received intercepted data packets, an extraction means for extracting intercepted data 
packets from fake data packets, and a means for adding a time information to said 
received intercepted data packets before storing them in said memory means. 

32. (AMENDED) A system according to claim 1 8, wherein said first network 
element comprises a detecting means for detecting a malfunction and/or breakage 
thereof, and signaling means for signaling an alarm to said interception gateway 
element in response to an output of said detecting means. 

33. (AMENDED) A network element for a packet network, comprising: 
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a) an interception means for intercepting a data packet received from said packet 
network, and 

b) a transmitting means for transmitting said intercepted data packet via said 
packet network to an interception gateway element, 

c) wherein said interception means is controlled by an interception control means 
arranged in another network element. 

34. (AMENDED) An interception gateway element for an interception system of a 
packet network, comprising: 

a) a receiving means for receiving an intercepted data packet via said packet 
network from a network element having an interception function; and 

b) an interface means for providing an interface to an intercepting authority. 

35. (AMENDED) An interception gateway element according to claim 34, further 
comprising an interception control means for controlling said interception function of 
said network element. 
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REMARKS 

The above preliminary amendment is made to insert an abstract page into the 
application and amend claims 1-4, 6-8, 10, 12-35. 

Applicant respectfully requests that this preliminary amendment be entered into 
the record prior to calculation of the filing fee and prior to examination and 
consideration of the above-identified application. 

If a telephone conference would be helpful in resolving any issues concerning 
this communication, please contact Applicant's attorney of record, Michael B. Lasky at 
952-912-0527. 



Respectfully submitted, 



Altera Law Group, LLC 
6500 City West Parkway, Suite 100 
Minneapolis, MTVl 55344-7701 
[952W 12-0527 




Date: July 10. 2001 



By: 



viichael B. Lasky 
Reg. No. 29,555 
MBL/jsa 
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Appendix A 
Marked Up Version of Entire Claim Set 

1 . (AMENDED) An interception method for performing a lawful interception in a 
packet network, comprising the steps of: 

providing a first network element [(LIN)] having an interception function for intercepting 
data packets; 

b) controlling said interception function by an interception control means [(26)] 
implemented in a second network element [(LIG)]; and 

c) transmitting an intercepted data packet from said first network element [(LIN)] 
via said packet network to an interception gateway element [(LIG)] providing an 
interface to at least one intercepting authority [(LEA)]. 

2. (AMENDED) A method according to claim 1 , wherein said interception 
gateway element [(LIG)] is integrated in said second network element. 

3. (AMENDED) A method according to claim 1 [or 2], wherein a header of a data 
packet is read by said network element [(LIN)] and data packets to be intercepted 
are duplicated. 

4. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepted data packet is transmitted to said interception gateway 
element [(LIG)] using a secure tunnel. 
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5. A method according to claim 4, wherein said secure tunnel is implemented by 
an encryption processing. 

6. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepted data packet is transmitted via interworking units [(IWU)] and 
encrypted between said interworking units, when said first network element [(LIN)] and 
said interception gateway element [(LIG)] are arranged in separate network segments. 

7. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said first network element is provided in each network segment of said packet 
network. 

8. (AMENDED) A method according to [any one of the preceding] claimfs] 1, 
wherein received intercepted data packets are collected in said interception gateway 
element [(LIG)] and supplied to an interface of said at least one intercepting authority 
[(LEA)]. 

9. A method according to claim 8, wherein said interface comprises a first 
interface for administrative tasks, a second interface for network signaling, and a third 
interface for intercepted user data. 
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10. (AMENDED) A method according to [any one of the preceding] claim[s] 1 , 
wherein said intercepting function comprises a packet sniffing and filtering function. 

11. A method according to claim 1 0, wherein said intercepting function is 
implemented in the Gn interface. 

12. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said interception function comprises reading data packets, analyzing the 
header of the data packets as to whether the data packet should be intercepted or not, 
and transmitting the data packet to said interception gateway element [(LIG)l, and a 
management function for interception and transmission criteria. 

13. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein an alarm is transmitted to said interception gateway element [(LIG)] and all 
interception information of a respective network element [(LIN)] is deleted, when a 
breakage of a casing of the respective network element has been detected. 

14. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein fake packets are transmitted from said network element [(LIN)] to said 
interception gateway element [(LIG)]. 

15. (AMENDED) A method according to claim 14, wherein said fake packets are 
transmitted at random or triggered at any passing packet, such that the total load of 
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intercepted and fake packets transmitted to said interception gateway element [(LIG)] 
is constant. 

1 6. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepted data packet is padded to a maximum length. 

1 7. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein a time information is added to said intercepted data packet. 

18. (AMENDED) An interception system for performing a lawful interception in a 
packet network, comprising: 

a) a first network element [(LIN)] having an interception function for intercepting 
data packets and comprising a transmitting means [(14)] for transmitting an 
intercepted data packet to said packet network; 

b) an interception control means [(26)] implemented in a second network element 
[(LIG)] and controlling the interception function; and 

c) an interception gateway element [(LIG)] having a receiving means [(21)1 for 
receiving said intercepted data packet and an interface means [(27)] for providing an 
interface to at least one intercepting authority [(LEA)]. 

19. (AMENDED) A system according to claim 18, wherein said second network 
element corresponds to said interception gateway element [(LIG)]. 



13 



20. (AMENDED) A system according to claim 18 [or 19], wherein said first network 
element [(LIN)] further comprises an encrypting means [(12)] for encrypting said 
intercepted data packet. 

21 . (AMENDED) A system according to [any one of] claimfs] 1 8 [to 20], wherein 
said first network element [(LIN)] further comprises a means [(13)] for generating fake 
packets to be transmitted with said intercepted data packets. 

22. (AMENDED) A system according to [anyone of] claim[s] 18 [to 21], wherein said 
first network element [(LIN)] comprises a reading means [(11)] for reading a header of 
a received data packet and for duplicating a data packet to be intercepted. 

23. (AMENDED) A system according to claim 22, wherein said reading means 
[(11)] is arranged to pad said copied data packet to a maximum length. 

24. (AMENDED) A system according to [anyone of] claim[s] 1 8 [to 23], wherein said 
first network element [(LIN)] is a gateway element of said packet network. 

25. (AMENDED) A system according to [any one of] claimfs] 18 [to 23], wherein 
said first network element [(LIN)] is a BG, an SGSN or a GGSN. 
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26. (AMENDED) A system according to claim 24 [or 25], wherein an interception 
information defining a data packet to be intercepted is included in a context information 
supplied to said first network element [(LIN)] and used for routing data packets. 

27. (AMENDED) A system according to claim 26, wherein said interception control 
means [(26)] comprises a storing means for storing an interception list, and wherein 
said interception control means [(26)] is arranged to add said interception information 
to said context information supplied to said first network element. 

28. (AMENDED) A system according to [any one of] claim[s] 18 [to 27], wherein 
said first network element [(LIN)] is arranged in each segment of said packet network. 

29. (AMENDED) A system according to [anyone of] claim[s] 18 [to 28], wherein said 
first network element [(LIN)] comprises a control means [(15)] for controlling 
interception and encryption processing in accordance with an interception setting 
instruction received from said interception control means [(26)]. 

30. (AMENDED) A system according to [anyone of] claim[s] 18 [to 29], wherein said 
interception gateway element [(LIG)] comprises a memory means [(25)] for storing 
received intercepted data packets before supplying them to said interface means 
[(27)]. 

31 . (AMENDED) A system according to claim 30, wherein said interception 
gateway element [(LIG)] comprises a decryption means [(22)] for removing an 
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encryption of the received intercepted data packets, an extraction means [(23)] for 
extracting intercepted data packets from fake data packets, and a means [(24)] for 
adding a time information to said received intercepted data packets before storing 
them in said memory means [(25)]. 

32. (AMENDED) A system according to [any one of] claim[s] 1 8 [to 31], wherein 
said first network element [(LIN)] comprises a detecting means for detecting a 
malfunction and/or breakage thereof, and signaling means for signaling an alarm to 
said interception gateway element [(LIG)] in response to an output of said detecting 
means. 

33. (AMENDED) A network element for a packet network, comprising: 

a) an interception means [(11,1 5)] for intercepting a data packet received from 
said packet network, and 

b) a transmitting means [(14)] for transmitting said intercepted data packet via said 
packet network to an interception gateway element, 

c) wherein said interception means is controlled by an interception control means 
[(26)] arranged in another network element [(LIG)]. 

34. (AMENDED) An interception gateway element for an interception system of a 
packet network, comprising: 

a) a receiving means [(21)] for receiving an intercepted data packet via said 

packet network from a network element [(LIN)] having an interception function; 
and 
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b) an interface means [(27)] for providing an interface to an intercepting authority 
[(LEA)]. 



35. (AMENDED) An interception gateway element according to claim 34, further 
comprising an interception control means [(26)] for controlling said interception 
function of said network element [(LIN)]. 
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